HTML5 Raises New Security Issues
As HTML5 enhances the Web, so too will it bring new vulnerabilities, security experts warn — IDG News Service — When it comes to new security issues, the security team for the Firefox browser have the new version of the Web HyperText Markup Language, HTML5, foremost on the mind.
Context & Ripple Effects
HTML5 has been gaining adoption momentum since April, when Microsoft's IE team laid out its own HTML5 video position, and Apple's campaign against Adobe Flash is pushing more sites toward HTML5 interfaces. That shift moves capabilities once isolated inside plugins directly into the browser, which is exactly why security experts warn the standard's enhancements come bundled with new vulnerabilities.
First-order effects
- Mozilla's Firefox security team now treats HTML5's new feature set as a primary audit target, adding attack surface that must be reviewed before each release.
- Sites adopting HTML5 interfaces inherit vulnerabilities in the browser rather than in third-party plugins, shifting exposure onto the browser vendors themselves.
Second-order effects
- Browser makers competing for share — with Firefox long cast as the frontrunner against Internet Explorer — can differentiate on security response speed, making vulnerability turnaround a competitive metric.
- If plugin-replaced functionality proves harder to secure inside the browser, some site operators may hesitate on HTML5 adoption, slowing the migration away from Flash that Apple is pushing.
Third-order effects
- Security responsibility consolidates around browser vendors: as the browser becomes the platform, its patch cadence — a discipline Mozilla has shown before, such as the Firefox 1.5 'undisclosed' hole patches in 2006 — becomes the de facto security perimeter for the web.
- Standards bodies face pressure to treat security review as part of specification work rather than an afterthought, since features ship to billions of users faster than ad-hoc hardening allows.
The trend: As HTML5 pulls capabilities out of plugins and into the browser itself, browser vendors are becoming the web's central security perimeter.